Various electronic equipment or devices can inter-communicate using wireless links. A popular technology for communication with low-power portable devices is radio frequency identification (RFID). Standardized RFID technology provides communication between an interrogator (or “reader”) and a “tag” (or “transponder”), a portable device that transmits an information code or other information to the reader. Tags are generally much lower-cost than readers. RFID standards exist for different frequency bands, e.g., 125 kHz (LF, inductive or magnetic-field coupling in the near field), 13.56 MHz (HF, inductive coupling), 433 MHz, 860-960 MHz (UHF, e.g., 915 MHz, RF coupling beyond the near field), or 2.4 GHz. Tags can use inductive, capacitive, or RF coupling (e.g., backscatter, discussed below) to communicate with readers. Although the term “reader” is commonly used to describe interrogators, “readers” (i.e., interrogators) can also write data to tags and issue commands to tags. For example, a reader can issue a “kill command” to cause a tag to render itself permanently inoperative.
Radio frequency identification systems are typically categorized as either “active” or “passive.” In an active RFID system, tags are powered by an internal battery, and data written into active tags can be rewritten and modified. In a passive RFID system, tags operate without an internal power source and are typically programmed with a unique set of data that cannot be modified. A typical passive RFID system includes a reader and a plurality of passive tags. The tags respond with stored information to coded RF signals that are typically sent from the reader. Further details of RFID systems are given in commonly-assigned U.S. Pat. No. 7,969,286 to Adelbert, and in U.S. Pat. No. 6,725,014 to Voegele, both of which are incorporated herein by reference.
In a commercial or industrial setting, tags can be used to identify containers of products used in various processes. A container with a tag affixed thereto is referred to herein as a “tagged container.” Tags on containers can carry information about the type of products in those containers and the source of those products. For example, as described in the GS1 EPC Tag Data Standard ver. 1.6, ratified Sep. 9, 2011, incorporated herein by reference, a tag can carry a “Serialized Global Trade Item Number” (SGTIN). Each SGTIN uniquely identifies a particular instance of a trade item, such as a specific manufactured item. For example, a manufacturer of cast-iron skillets can have, as a “product” (in GS1 terms) a 10″ skillet. Each 10″ skillet manufactured has the same UPC code, called a “Global Trade Item Number” (GTIN). Each 10″ skillet the manufacturer produces is an “instance” of the product, in GS1 terms, and has a unique Serialized GTIN (SGTIN). The SGTIN identifies the company that makes the product and the product itself (together, the GTIN), and the serial number of the instance. Each box in which a 10″ skillet is packed can have affixed thereto an RFID tag bearing the SGTIN of the particular skillet packed in that box. SGTINs and related identifiers, carried on RFID tags, can permit verifying that the correct products are used at various points in a process.
However, RFID tags in general, and specifically passive tags, often do not have enough processing power or memory to perform cryptographic authentication or authorization functions, such as secure hashing with time-varying salt. Consequently, every read of a tag returns the same data. As a result, RFID systems can be vulnerable to attacks in which a rogue (non-authorized) reader placed near a tag reads and stores that tag's data. This process is called “skimming,” and such rogue readers are referred to as “skimmers.” The skimmer can later replay the stored data (a “replay attack”) to pretend to be the skimmed tag. This can result in incorrect products being used in industrial or commercial processes, or mishandled inventory in a retail environment, possibly resulting in lost productivity or wasted product. Skimmers can actively interrogate RFID tags, or passively wait and record data sent by tags being interrogated by authorized readers. In other cases, skimmers can passively record the data transfers by which an authorized reader opens a communications session with an RFID tag. The skimmer can then use this information to open a communications session with the RFID tag and make unauthorized changes to data stored on the tag.
Various schemes have been proposed to reduce vulnerability of RFID systems to skimmers. U.S. Patent Publication No. 2009/0174556 by Home et al. describes an RFID blocker that disrupts an RFID reader's signal to a tag when the blocker is physically near the tag. However, the blocker will disrupt all accesses, not just unauthorized access. In another scheme, U.S. Patent Publication No. 2009/0021343 by Sinha describes jamming or spoofing skimmers, either from authorized electronics or from intrusion-prevention tags, in response to intrusions or policy violations. U.S. Pat. No. 7,086,587 to Myllymaki describes RFID readers that can detect unauthorized tags, and tags that can detect unauthorized readers. However, none of these schemes reduces the probability of passive monitoring by a skimmer during an authorized read of the tag.
There is, therefore, a continuing need for a way of detecting an RFID tag without rendering the tag vulnerable to skimming.